CVE-2026-23511CWE-204

ZITADEL has a user enumeration vulnerability in Login UIs

Medium · published January 15, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-01-15T19:09Z
EPSS history
Timeline
  • 15 JAN 19:09Z
    ZITADEL has a user enumeration vulnerability in Login UIs
    cvelistv5